nx_sync_promote_gate.nx source
↩ module page · 173 lines · 8702 B
1// nx_sync_promote_gate.nx -- proves the PROMOTABLE sync lane (2026-08-22).
2// The defect it guards: the synchronous MCP lane, at its deadline, forked a WATCHDOG that SIGKILLed the
3// worker -- DESTROYING THE ANSWER of every call that outran the 15s edge window while the work itself ran
4// on and its side effects landed. The fix (tr_run_capture_deadline) instead PROMOTES the still-running
5// worker: it returns TR_PROMOTE plus the live pid and read end, and the caller adopts it onto the job lane.
6// This gate drives that function IN-PROCESS against a real fixture ELF (nx_slowtick), so it needs no
7// daemon and no socket -- and it proves the window-pair SSOT (edge_window.conf vs the compiled fallback).
8// SUBJECT for the bite: buildroot/runtime/nx_tool_run.nx (tr_run_capture_deadline) + the fixture
9// _offc/nx_slowtick.elf. The 4th nx_gate_bite arg is MANDATORY (this fork/execs a deployed fixture).
10// BITE-PROVEN 2026-08-22: the targeted incumbent-revert mutation (the promotion arm
11// `if pr == 0 { promoted = 1 }` -> `nx_kill(pid, TR_SIGKILL)`) flipped T1/T2/T3 RED (6/9) while T4-T9
12// stayed GREEN, and the pristine restore rebuilt byte-identical (b53a887a). The auto-bite was
13// INCONCLUSIVE (generic mutations do not reach the promote/kill decision); the targeted mutation is the
14// real non-vacuity proof and it is recorded here so the next reader need not re-derive it.
15// license_tier: ORIGINAL expect_exit: 0
16import "nx_tool_exec_allow.nx" // tr_run_capture_deadline + TR_PROMOTE (via nx_tool_run) + tea_edge_window_ms_from + tea_sync_promote_ms_from
17import "nx_gate_verdict.nx"
18
19const SPG_FIX: *u8 = "_offc/nx_slowtick.elf" as *u8
20const SPG_CAP: i64 = 65536
21const SPG_DEADLINE_MS: i64 = 150 // < the fixture's 600ms sleep, so it is genuinely mid-run at the deadline
22const SPG_LONG_MS: i64 = 5000 // > any fixture runtime, so the fast path finishes inline
23const SPG_DRAIN_MS: i64 = 4000 // upper bound on how long we wait for the promoted tail
24const SPG_POLLFD_BYTES: i64 = 8
25const SPG_POLLIN: i64 = 1
26const SPG_PF_EV_OFF: i64 = 4
27const SPG_PF_FD_BYTES: i64 = 4
28const SPG_BITS: i64 = 8
29const SPG_MASK: i64 = 0xff
30
31const SPG_FIXCONF_DIR: *u8 = "/tmp/nx_sync_promote_gate" as *u8
32const SPG_FIXCONF_OK: *u8 = "/tmp/nx_sync_promote_gate/edge_window.conf" as *u8
33const SPG_FIXCONF_BAD: *u8 = "/tmp/nx_sync_promote_gate/edge_window_bad.conf" as *u8
34const SPG_FIXCONF_NONE: *u8 = "/tmp/nx_sync_promote_gate/edge_window_absent.conf" as *u8
35const SPG_MODE_DIR: i64 = 493 // 0755
36const SPG_MODE_644: i64 = 420
37const SPG_OTRUNC: i64 = 0x241 // O_WRONLY|O_CREAT|O_TRUNC
38const SPG_AT_FDCWD: i64 = 0 - 100
39const SPG_SYS_OPENAT: i64 = 257
40
41// local substring finder -- the gate does not import nx_tools_api, so it does not borrow ta_indexof.
42func spg_has(buf: *u8, n: i64, needle: *u8) -> i64 {
43 var nl: i64 = 0
44 while needle[nl] != (0 as u8) { nl = nl + 1 }
45 if nl == 0 { return 1 }
46 var i: i64 = 0
47 while i + nl <= n {
48 var j: i64 = 0
49 var m: i64 = 1
50 while j < nl { if (buf[i + j] as i64) != (needle[j] as i64) { m = 0; j = nl } else { j = j + 1 } }
51 if m == 1 { return 1 }
52 i = i + 1
53 }
54 return 0
55}
56
57func spg_write(path: *u8, content: *u8) -> i64 {
58 let fd: i64 = __syscall(SPG_SYS_OPENAT, SPG_AT_FDCWD, path, SPG_OTRUNC, SPG_MODE_644, 0, 0)
59 if fd < 0 { return 0 - 1 }
60 var n: i64 = 0; while content[n] != (0 as u8) { n = n + 1 }
61 sys_write(fd, content, n); sys_close(fd)
62 return 0
63}
64
65// drain a fd to EOF (bounded by a whole-call deadline) into out; returns bytes read.
66func spg_drain(rfd: i64, out: *u8, cap: i64, deadline_ms: i64) -> i64 {
67 let pfd: *u8 = sys_mmap(SPG_POLLFD_BYTES)
68 let t0: i64 = sys_now_ms()
69 var total: i64 = 0
70 var run: i64 = 1
71 while run == 1 {
72 if total >= cap { run = 0 } else {
73 var remaining: i64 = deadline_ms - (sys_now_ms() - t0)
74 if remaining < 0 { remaining = 0 }
75 var k: i64 = 0
76 while k < SPG_PF_FD_BYTES { pfd[k] = ((rfd >> (k * SPG_BITS)) & SPG_MASK) as u8; k = k + 1 }
77 pfd[SPG_PF_EV_OFF] = SPG_POLLIN as u8
78 pfd[SPG_PF_EV_OFF + 1] = 0 as u8
79 pfd[SPG_PF_EV_OFF + 2] = 0 as u8
80 pfd[SPG_PF_EV_OFF + 3] = 0 as u8
81 let pr: i64 = sys_poll(pfd, 1, remaining)
82 if pr > 0 {
83 let r: i64 = sys_read(rfd, ((out as i64) + total) as *u8, cap - total)
84 if r > 0 { total = total + r } else { run = 0 }
85 } else { run = 0 }
86 }
87 }
88 return total
89}
90
91func main() -> i64 {
92 let ctr: *i64 = gv_ctr()
93 gv_head("nx_sync_promote_gate -- the sync lane PROMOTES a slow worker instead of killing it" as *u8)
94
95 let fchk: i64 = sys_openat_rd(SPG_FIX)
96 var fpres: i64 = 0
97 if fchk >= 0 { fpres = 1; sys_close(fchk) }
98 gv_need("fixture _offc/nx_slowtick.elf present" as *u8, fpres, ctr)
99
100 let out: *u8 = sys_mmap(SPG_CAP)
101 let olen: *i64 = sys_mmap(16) as *i64
102 let wpid: *i64 = sys_mmap(16) as *i64
103 let wrfd: *i64 = sys_mmap(16) as *i64
104
105 let av1: *i64 = sys_mmap(64) as *i64
106 av1[0] = SPG_FIX as i64
107 av1[1] = "600" as *u8 as i64
108 av1[2] = 0
109 let rc1: i64 = tr_run_capture_deadline(SPG_FIX, av1, out, SPG_CAP, olen, SPG_DEADLINE_MS, wpid, wrfd)
110 var t1: i64 = 0
111 if rc1 == TR_PROMOTE { if spg_has(out, olen[0], "SLOW-PRE" as *u8) == 1 { if spg_has(out, olen[0], "SLOW-TAIL-OK" as *u8) == 0 { t1 = 1 } } }
112 gv_check("T1 fixture-reached: at the deadline the worker has emitted SLOW-PRE but NOT its tail" as *u8, t1, ctr)
113
114 var t2: i64 = 0
115 if rc1 == TR_PROMOTE {
116 let tail: *u8 = sys_mmap(SPG_CAP)
117 let tn: i64 = spg_drain(wrfd[0], tail, SPG_CAP, SPG_DRAIN_MS)
118 if spg_has(tail, tn, "SLOW-TAIL-OK" as *u8) == 1 { t2 = 1 }
119 sys_close(wrfd[0])
120 let st: *i64 = sys_mmap(16) as *i64
121 sys_wait4(wpid[0], st, 0)
122 }
123 gv_check("T2 promoted worker SURVIVES the deadline: its post-deadline tail arrives on the drained pipe" as *u8, t2, ctr)
124
125 var t3: i64 = 0
126 if rc1 == TR_PROMOTE { if wpid[0] > 0 { if wrfd[0] >= 0 { t3 = 1 } } }
127 gv_check("T3 slow call returns TR_PROMOTE with a live worker pid and read end" as *u8, t3, ctr)
128
129 let av2: *i64 = sys_mmap(64) as *i64
130 av2[0] = SPG_FIX as i64
131 av2[1] = "0" as *u8 as i64
132 av2[2] = 0
133 let rc2: i64 = tr_run_capture_deadline(SPG_FIX, av2, out, SPG_CAP, olen, SPG_LONG_MS, wpid, wrfd)
134 var t4: i64 = 0
135 if rc2 == 0 { if spg_has(out, olen[0], "FAST-OK" as *u8) == 1 { t4 = 1 } }
136 gv_check("T4 anti-vacuity: a call that finishes inside the deadline returns its exit code, not TR_PROMOTE" as *u8, t4, ctr)
137
138 let av3: *i64 = sys_mmap(64) as *i64
139 av3[0] = SPG_FIX as i64
140 av3[1] = "200" as *u8 as i64
141 av3[2] = 0
142 let rc3: i64 = tr_run_capture_deadline(SPG_FIX, av3, out, SPG_CAP, olen, 0, wpid, wrfd)
143 var t5: i64 = 0
144 if rc3 != TR_PROMOTE { if spg_has(out, olen[0], "SLOW-TAIL-OK" as *u8) == 1 { t5 = 1 } }
145 gv_check("T5 neg-control deadline<=0: unbounded opt-out runs to completion, never promotes" as *u8, t5, ctr)
146
147 sys_mkdir(SPG_FIXCONF_DIR, SPG_MODE_DIR)
148 spg_write(SPG_FIXCONF_OK, "edge_window_ms 15000\nreply_reserve_ms 1000\n" as *u8)
149 spg_write(SPG_FIXCONF_BAD, "edge_window_ms 9999\nreply_reserve_ms 1000\n" as *u8)
150 let srcp: *i64 = sys_mmap(16) as *i64
151
152 let wv: i64 = tea_edge_window_ms_from(SPG_FIXCONF_OK, srcp)
153 var t6: i64 = 0
154 if wv == TEA_EDGE_WINDOW_MS { if srcp[0] == TEA_SRC_CONF { t6 = 1 } }
155 gv_check("T6 conf edge_window_ms equals the compiled fallback, read FROM the conf (src=CONF)" as *u8, t6, ctr)
156
157 let bv: i64 = tea_edge_window_ms_from(SPG_FIXCONF_BAD, srcp)
158 var t7: i64 = 0
159 if bv == 9999 { if bv != TEA_EDGE_WINDOW_MS { if srcp[0] == TEA_SRC_CONF { t7 = 1 } } }
160 gv_check("T7 neg-control: a mismatched conf reads its OWN value, provably != the compiled constant" as *u8, t7, ctr)
161
162 let nv: i64 = tea_edge_window_ms_from(SPG_FIXCONF_NONE, srcp)
163 var t8: i64 = 0
164 if nv == TEA_EDGE_WINDOW_MS { if srcp[0] == TEA_SRC_DEFAULT { t8 = 1 } }
165 gv_check("T8 neg-control: an absent conf uses the compiled default and declares src=DEFAULT" as *u8, t8, ctr)
166
167 let pm: i64 = tea_sync_promote_ms_from(SPG_FIXCONF_OK, srcp)
168 var t9: i64 = 0
169 if pm == 15000 - 1000 { t9 = 1 }
170 gv_check("T9 sync-promote deadline is DERIVED window-reserve (14000), never a separate literal" as *u8, t9, ctr)
171
172 return gv_verdict("SYNC-PROMOTE-GATE" as *u8, ctr, "the sync lane promotes a slow worker onto the job lane instead of SIGKILLing it; the window pair has one owner (bite-proven: the incumbent-SIGKILL mutation flips T1-T3 RED)" as *u8)
173}